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About PTAC 


The U.S. Department of Education established the Privacy Technical Assistance Center (PTAC) as a 
“one-stop” resource for education stakeholders to learn about data privacy, confidentiality, and security 
practices related to student-level longitudinal data systems and other uses of student data. PTAC 
provides timely information and updated guidance through a variety of resources, including training 
materials and opportunities to receive direct assistance with privacy, security, and confidentiality of 
student data systems. More PTAC information is available at https://studentprivacy.ed.gov. PTAC 
welcomes input on this document and suggestions for future technical assistance resources relating to 
student privacy. Comments and suggestions can be sent to PrivacyTA@ed.gov. 


Introduction 


School officials routinely seek to balance the interests of safety and privacy for students. While the 
Family Educational Rights and Privacy Act (FERPA) generally requires written parent or “eligible 
student”! consent before an educational agency (district) or institution (school) discloses student 
education records and the personally identifiable information (PII) contained therein, FERPA gives 
schools and districts flexibility to disclose Pll, under certain limited circumstances, in order to maintain 
school safety. The purpose of this guidance is to address questions about how FERPA applies to schools’ 
and districts’ disclosures of PII from student education records to school security units, outside law 
enforcement entities, School Resource Officers (SROs), and other schools. While the information in this 
guidance is applicable to all educational agencies and institutions that receive funds under any program 
administered by the Secretary of the U.S. Department of Education (Department), the discussion is 
generally focused on health or safety emergencies faced by public elementary and secondary schools. 


Many schools and school districts have their own security units to monitor safety and security in and 
around school campuses. In FERPA, these entities are called “law enforcement units” if certain 
conditions are met. Some schools designate a particular school official or office to be responsible for 
referring potential or alleged violations of law to local law enforcement authorities. Other schools 
contract with off-duty police officers to provide school security, while still others utilize the services of 
an SRO, who serves as an on-site law enforcement officer and liaison with the local police or sheriffs 
department for reporting offenses and filing charges. Still others utilize a hybrid system combining one 
or more of the preceding methods. 


FERPA affords schools and districts flexibility when responding to circumstances that threaten the health 
or safety of individuals in their school community. Understanding the provisions of FERPA relative to 
such circumstances will empower school officials to act decisively and quickly when challenges arise. The 
following frequently asked questions detail how FERPA may apply in these circumstances. Although this 
guidance is focused on FERPA, there may be other federal and State laws, such as civil rights and privacy 


' When a student turns eighteen years of age, or enrolls in a postsecondary institution at any age, the student 
becomes an “eligible student” (34 CFR §99.3 “eligible student”) and all rights under FERPA transfer from the 
parent to the student. 34 CFR §99.5(a)(1) 
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laws, that are relevant to decision-making regarding when and with whom schools and districts may 
disclose, without appropriate consent, student information. At the federal level, for example, public 
elementary and secondary schools are subject to federal civil rights laws, including laws that prohibit 
discrimination based on: disability (the Americans with Disabilities Act (ADA) and Section 504 of the 
Rehabilitation Act of 1973); race, color, and national origin (Titles IV and VI of the Civil Right Act of 
1964); sex (Title IX of the Education Amendments of 1972); and religion (Title IV of the Civil Rights Act 
of 1964). Also, State educational agencies and local educational agencies must comply with the 
requirements of Part B of the Individuals with Disabilities Education Act (IDEA) in educating children 
with disabilities, including IDEA’s confidentiality of information requirements.? 


? See 20 U.S.C. 1417(c) and 34 CFR §§300.610-300.626. 
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General Requirements of the Family Educational Rights and Privacy Act (FERPA) 
Applicable to this Guidance 


Q.1. 


Q.2. 


Q.3. 


Do any laws other than FERPA address the disclosure of personally identifiable 
information (PII) from students’ education records or other disclosures of 
information on students? 


Yes. As noted in the “Introduction” section, there may be other federal and State laws, as well 
as local policies that address information sharing on students, including laws concerning the civil 
rights of students.3 In addition, the education records of students who are children with 
disabilities are not only protected by FERPA but also by the confidentiality of information 
provisions in the Individuals with Disabilities Education Act (IDEA).4 (See Q.5) Among other 
laws, student records may, under some circumstances, also be covered by the provisions of the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the Richard B. Russell 
National School Lunch Act.5 


What is FERPA and to which entities does it apply? 


FERPA is a federal law that protects the privacy of student education records, and the PIl 
contained therein, maintained by educational agencies or institutions or by a party acting for the 
agencies or institutions. The FERPA statute is found at 20 U.S.C. § 1232g and its implementing 
regulations are set forth at 34 CFR Part 99. FERPA applies to all educational agencies and 
institutions that receive funds under any program administered by the Secretary of the U.S. 
Department of Education (Department).6 The term “educational agencies and institutions” 
generally refers to local educational agencies (LEAs), elementary and secondary schools, and 
postsecondary institutions. Private schools at the elementary and secondary levels generally do 
not receive funds from the Department and are, therefore, not subject to FERPA, but may be 
subject to other data privacy laws such as HIPAA. In this guidance, when we refer to LEAs, 
school districts, or schools, we mean “educational agencies and institutions,” as applicable, 
subject to FERPA. A copy of the regulations may be found on our website at: 
https://studentprivacy.ed.gov/ 


To whom does the information in this guidance apply? 


The information in this guidance applies to all educational agencies and institutions. That said, 
the guidance generally focuses on addressing health or safety emergency situations faced by the 
elementary and secondary school community. For additional information on FERPA’s application 
to health or safety emergency situations in the postsecondary institution context, please refer to 


3 Many State laws provide greater privacy protections than FERPA does, however FERPA establishes a minimum 
federal standard governing the privacy of education records and the Pll contained therein. 

* For additional information on the interaction of FERPA and IDEA confidentiality provisions, please refer to 
previously issued Department guidance entitled, “IDEA and FERPA Confidentiality Provisions,” issued in June 2014, 
available at: https://studentprivacy.ed.gov/resources/ferpaidea-cross-walk. 

° For information relating to the interaction of FERPA and HIPAA with respect to student health records, please 
refer to the “Joint Guidance on the Application of the Family Educational Rights and Privacy Act (FERPA) And the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA) To Student Health Records” issued by the 
U.S. Department of Education and the U.S. Department of Health and Human Services in November 2008, 
available at: https://studentprivacy.ed.gov/resources/joint-guidance-application-ferpa-and-hipaa-student-health- 


records 


° 34 CFR § 99.1 
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previously issued Department guidance entitled, “Addressing Emergencies on Campus,” issued 
in June 2011, available at: https://studentprivacy.ed.gov/resources/addressing-emergencies- 
campus. Additionally, the Department has released several guides for developing emergency 
operations plans for elementary and secondary schools, school districts, and postsecondary 
institutions. These guides may be found at: https://rems.ed.gov/Resource_Plan_Basic_EOP.aspx. 


Q.4. What are the rights of parents and students under FERPA? 


FERPA affords parents certain rights with respect to their children’s education records 
maintained by schools and school districts to which FERPA applies. These include the right to 
inspect and review their children’s education records, the right to seek to have the education 
records amended, and the right to have some control over the disclosure of Pll contained in the 
education records.” These rights transfer to the student when he or she reaches the age of |8 
years or attends a postsecondary institution at any age (and thereby becomes an “eligible 
student” under FERPA).® 


Q.5. What are “education records’? 


The term “education records” is defined, with certain exceptions, as those records that are: (I) 
directly related to a student; and (2) maintained by an educational agency or institution, or by a 
party acting for the agency or institution.? Records on children with disabilities who receive 
evaluations, services, or other benefits under Part B of the IDEA are subject to IDEA’s 
“Confidentiality of Information” requirements, in addition to being considered “education 
records” subject to FERPA. !° 


Q.6. Are there any types of records or documents that are specifically excluded from the 
definition of ‘“‘education records’”’ under FERPA? 


Yes. There are several categories of records that may be maintained by an educational agency or 
institution that are not “education records” under FERPA.'! One such category of records — 
records of a “law enforcement unit” — is particularly relevant to school safety and is discussed in 
detail in Qs 18 and 19, below. 


Q.7. What is “directory information” and is it protected by FERPA? 


FERPA defines “directory information” as information contained in a student’s education record 
that would not generally be considered harmful or an invasion of privacy if disclosed.!2 Directory 
information may include, but is not limited to, the student’s name; address; telephone listing; 
electronic mail address; photograph; date and place of birth; major field of study; grade level; 
dates of attendance; participation in officially recognized activities and sports; weight and height 


720 U.S.C. §§ 1232g(a)(1) and (2), (b), (h), (i), and (j); 34 CFR Part 99, Subparts B, C, and D. 

° 34 CFR §§ 99.3, “Eligible student,” and 99.5 

? 34 CFR § 99.3, “Education records.” 

'° 34 CFR §§ 300.610 — 300.626 

'' Please refer to the definition of “education records” set forth in FERPA at 20 U.S.C. § 1232g(a)(4) and the 
implementing regulations at 34 CFR § 99.3 for further information on the types of records that are not considered 
“education records.” 

'2 34 CFR § 99.3, “Directory information.” 
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Q.8. 


Q.9. 


8 Ibid. 


of members of athletic teams; degrees, honors, and awards received; and the most recent 
educational agency or institution attended.!3 


The disclosure of appropriately designated directory information, under certain specified 
conditions, is one of the exceptions to FERPA’s general written consent requirement.'4 A school 
or district may disclose directory information, without the parent or eligible student’s written 
consent, to third parties, including law enforcement officials, if it has given public notice to 
parents and eligible students of (1) the types of Pll that it has designated as “directory 
information,” (2) the right of the parent or eligible student to restrict the disclosure of such 
information, and (3) the period of time within which a parent or eligible student has to notify 
the educational agency or institution in writing that he or she does not want any or all of those 
types of information designated as “directory information.”!5 In addition, a school or district may 
implement a limited directory information policy by specifying in its public notice to parents and 
eligible students that its disclosure of appropriately designated directory information will be 
limited to specific parties (and not others), for specific purposes, or both.!é 


What is “personally identifiable information” under FERPA? 


Personally identifiable information (PII) is defined to include not only direct identifiers like the 
student’s name and Social Security number, but also indirect identifiers such as the student’s 
date and place of birth and the mother’s maiden name.!7 Pll also includes “[o]ther information 
that, alone or in combination, is linked or linkable to a specific student that would allow a 
reasonable person in the school community, who does not have personal knowledge of the 
relevant circumstances, to identify the student with reasonable certainty.”!® That is, in some 
cases, a record may not contain a direct or even an indirect identifier, but would still contain PIl 
under FERPA. For example, when an event at a school generates significant publicity, otherwise 
permissible non-consensual disclosures of redacted education records may no longer be 
permissible under FERPA because the publicity would allow a reasonable person in the school 
community to identify with reasonable certainty the student(s) involved. Pll also includes any 
information requested by a person who the educational agency or institution reasonably believes 
knows the identity of the student to whom the education records relates. 


Who must provide consent for the disclosure of PII from a student’s education 
records? 


In general, with certain exceptions, before an educational agency or institution discloses Pll from 
a student’s education record, the student’s parent or the eligible student must provide a signed 
and dated written consent. That consent must specify the education records (or the Pll 
contained in those records) that may be disclosed, must state the purposes of the disclosure, 
and must identify the party or class of parties to whom the disclosure may be made.!? 


3 Id; 20 U.S.C. § 1232g(a)(5)(A). 

* 34 CFR §§ 99.31 (a)(I1) and 99.37 

> 34 CFR § 99.37(a) 

° 34 CFR § 99.37(d) 

” 34 CFR § 99.3, “Personally Identifiable Information.” 


° 34 CFR § 99.30 


PTAC-FAQ-11, February 2019 8 


Q.10. Are there exceptions to FERPA’s general written consent requirement that permit 


schools and districts to disclose PII from education records without consent? 


Yes. While FERPA generally requires parents or eligible students to provide a school or district 
with written consent before the school or district discloses Pll from a student’s education 
records, there are a number of exceptions to this prior written consent requirement.2° For 
example, assuming that certain conditions are satisfied, FERPA permits a school or district to 
disclose education records under the “health or safety emergency” exception without obtaining 
prior written consent.?! Several of these exceptions to the consent requirement that are most 
relevant in the school safety context are discussed below. Additionally, as explained more fully 
in Q.19 below, because “law enforcement unit records” are not “education records,” they, 
therefore, may be disclosed, without the parent or eligible student’s consent, to outside parties 
under FERPA. Similarly, while IDEA generally also requires prior written consent from the 
parent (or from a student who has reached the age of majority under State law, if parental rights 
have transferred to the student) for disclosure of Pll from education records, IDEA generally 
incorporates the FERPA exceptions to the prior consent requirement.22 


Are schools and districts required to record the disclosure of PII from students’ 
education records whenever they make disclosures? 


Subject to certain exceptions addressed below, schools and districts must maintain a record of 
each request for access to and each disclosure of Pll from the education records of each 
student, as well as the names of State and local educational authorities and federal officials and 
agencies listed in 34 CFR § 99.31(a)(3) that may make further disclosures of Pll from the 
student’s education records without consent.23 The school or district must maintain the record 
of disclosure with the education records of the student as long as the education records are 
maintained.24 


For each request or disclosure, the record of disclosure must include: (I) the parties who have 
requested or received PIl from the education records; and (2) the legitimate interests the 
parties had in requesting or obtaining the information (i.e., under which exception to FERPA’s 
general written consent requirement the disclosure was made).2> As explained in the answer to 
Q.30 below, the school or district must record additional information whenever it discloses, 
without appropriate consent, Pll from a student’s education records under FERPA’s health or 
safety emergency exception.26 There are additional requirements that relate to recording 
further disclosures made by State and local authorities and federal officials and agencies listed 
under 34 CFR § 99.31 (a)(3) with which schools and districts should also be familiar.2” 


Schools and districts do not have to record requests for Pll from education records from, or 
disclosures of Pll from education records that were made to: (1) the parent or eligible student; 
(2) a school official under 34 CFR § 99.31 (a)(1); (3) a party with written consent from the 


2 20 US.C. §§ 1232g(b)(1), (b)(2), (b)(3), (b)(5), (b)(6), (h), (i), and (j); 34 CFR § 99.31 
2! 20 U.S.C. § 1232g(b)(1)(I); 34 CFR §§ 99.31 (a)(10) and 99.36 

22 34 CFR § 300.622 

23 20 US.C. § 1232g(b)(4)(A); 34 CFR § 99.32(a)(1) 

4 34 CFR § 99.32(a)(2) 

5 34 CFR § 99.32(a)(3). 

26 34 CFR § 99.32(a)(5) 

7 34 CFR §§ 99.32(a)(4) and (b)(2) 
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parent or eligible student; (4) a party seeking directory information; or (5) a party seeking or 
receiving records in accordance with the provisions in FERPA related to non-consensual 
disclosures pursuant to certain types of lawfully issued subpoenas or court orders.28 However, 
in the interests of promoting greater transparency, the Department considers it a best practice 
for schools and districts to voluntarily record such disclosures in certain situations, such as 
when records are produced pursuant to certain lawfully issued subpoenas or court orders. 


Disclosures of PII from Students’ Education Records Without Written Consent 
General 


Q.12. When are schools or districts required by FERPA to disclose PII from a student’s 
education records? 


FERPA does not contain any provisions that require schools or districts to “disclose” Pll from a 
student’s education records. The disclosures discussed in this guidance document describe the 
conditions under which a school or district may disclose education records without the parent 
or eligible student’s consent. That said, FERPA does require schools and districts as well as state 
educational agencies (SEA) and their components to provide parents and eligible students with 
the opportunity to “inspect and review” the student’s own education records.29 Further, if 
circumstances effectively prevent the parent or eligible student from exercising this right to 
inspect and review, the educational agency or institution, or SEA or its components, must 
provide the parent or eligible student with a copy of the education record requested or make 
other arrangements for the parent or eligible student to inspect and review the education 
record.30 


School Officials 


Q.13. Who qualifies as a “school official” under FERPA, and to whom may schools and 
districts disclose education records under the school official exception to FERPA’s 
general written consent requirement? 


FERPA permits schools and districts to disclose education records (and the PII contained in 
those records) without appropriate consent, to “school officials” provided that the school or 
district has determined that these school officials have “legitimate educational interests” in the 
education records.3! Under FERPA, a school or district must include in its annual notification of 
FERPA rights the specific criteria they use for determining who constitutes a “school official” 
and what constitutes a “legitimate educational interest.”32:3334 A “school official” may include, 


28 34 CFR §§ 99.31 (a)(9)(ii)(A)-(C); 34 CFR § 99.32(d) 

? 20 U.S.C. § 1232g(a)(1)(A) and (B); 34 CFR § 99.10(a) 

3° 34 CFR § 99.10(d) 

3! 20 U.S.C. § 1232g(b)(1)(A); 34 CFR § 99.31 (a)(1)(i)(A). 

32 34 CFR § 99.7(a)(3)(iii) 

3 The Department has created a “Model Notification of Rights under FERPA for Elementary and Secondary 
Schools,” available at: https://studentprivacy.ed.gov/resources/ferpa-model-notification-rights-elementary- 
secondary-schools 

* This notification must be distributed by a school or district every year through a means that is likely to be 
viewed by parents and eligible students, such as a student handbook, school website, or a direct letter to parents, 
and must inform parents and eligible students of their rights under FERPA. 
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Q.14. 


Q.15. 


but is not limited to, a teacher, school principal, president, chancellor, board member, trustee, 
registrar, counselor, admissions officer, attorney, accountant, human resources professional, 
information systems specialist, and support or clerical personnel. 


Contractors, consultants, volunteers, or other third parties to whom a school or district has 
outsourced certain functions may be also be considered “school officials.”35 Schools and districts 
may disclose education records (and the PII contained in those records), without appropriate 
consent to such school officials provided that they (1) perform an institutional service or 
function for which the school or district would otherwise use employees; (2) are under the 
“direct control” of the school or district with respect to the use and maintenance of the 
education records; (3) are subject to FERPA’s use and re-disclosure requirements set forth in 34 
CFR § 99.33(a); and (4) satisfy the criteria specified in the school or district’s annual notification 
of FERPA rights for being “school officials” with “legitimate educational interests” in the 
education records.3é 


Typically, a school official would have a “legitimate educational interest” if he or she needs to 
review an education record in order to fulfill his or her professional responsibilities. Please note 
that schools and districts must use reasonable methods to ensure that school officials obtain 
access to only those education records in which they have legitimate educational interests.37 If a 
school or district does not use physical or technological access controls, it must ensure that its 
administrative policy for controlling access to education records is effective and that it remains 
in compliance with FERPA’s legitimate educational interest requirement.38 


Can law enforcement unit officials who are school employees be considered school 
officials with legitimate educational interests? 


Yes, if certain conditions apply. A law enforcement unit official who is an employee of a school 
or district generally would be considered a school official to whom the school or district may 
disclose, without consent, education records (or PII contained in those records), if the law 
enforcement unit official meets the criteria specified in the school or district’s annual notification 
of FERPA rights to parents and eligible students for being a “school official” with a “legitimate 
educational interest” in the education records. In several questions below we discuss how the 
school official exception to FERPA’s general written consent requirement applies in situations in 
which the law enforcement unit is not comprised of school employees. 


Can law enforcement unit officials who are off-duty police officers or SROs be 
considered school officials under FERPA and, therefore, have access to students’ 
education records? 


Yes, if certain conditions are met. Under FERPA, schools and districts may consider law 
enforcement unit officials, such as off-duty police officers and SROs, to be “school officials” if the 
school or district has outsourced the function of providing safety and security for the school or 


35 34 CFR § 99.31 (a)(1)(i)(B) 
36 34 CFR § 99.31 (a)(1)(i) 
37 34 CFR § 99.31 (a)(1)(ii) 


38 Ibid 
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district to the law enforcement unit officials.39 Law enforcement unit officials could qualify as “school 
officials’ under FERPA if they: 


|. Perform an institutional service or function for which the school or district would otherwise use 
employees (e.g., to ensure school safety); 


2. Are under the “direct control” of the school or district with respect to the use and 
maintenance of the education records (e.g., through a memorandum of understanding (MOU) 
that establishes data use restrictions and data protection requirements); 


3. Are subject to FERPA’s use and re-disclosure requirements in 34 CFR § 99.33(a), which 
provides that the PIl from education records may be used only for the purposes for which the 
disclosure was made (e.g., to promote school safety and the physical security of students), and 
which limits the re-disclosure of Pll from education records; and 


4. Meet the criteria specified in the school or district’s annual notification of FERPA rights for being 
school officials with legitimate educational interests in the education records.*° 


The best practice to ensure compliance with these provisions is for the school and the law 
enforcement unit to enter into a MOU that specifically addresses these issues.?! 


As indicated in the listing above, off-duty police officers and SROs who qualify as “school officials” 
may only use PII from education records for the purposes for which the disclosure was made, e.g., 
to promote school safety and the physical security of the students.*2 In addition, these officers are 
subject to FERPA’s re-disclosure requirements in 34 CFR § 99.33(a). This means that an off-duty 
police officer or SRO who is acting as a “school official” under FERPA may not re-disclose, without 
appropriate consent, Pll from education records to outside parties, including other employees of his 
or her police department who are not acting as school officials, unless the disclosure satisfies an 
exception to FERPA’s general written consent requirement, as further discussed below (e.g., if the 
re-disclosure is made pursuant to a lawfully issued subpoena or court order*3 or to appropriate 
parties under the health and safety emergency exception). 


Threat Assessment Teams 


Q.16. What is a threat assessment team? 


A threat assessment team is a group of individuals who convene to identify, evaluate, and 
address threats or potential threats to school security. Threat assessment teams review 
incidents of threatening behavior by students (current and former), parents, school employees, 
or other individuals, and, based on the information received, relying on their collective 
expertise, provide guidance to school officials on how to respond to the potential threat. These 


3? 34 CFR § 99.31 (a)(1)(i)(B)(1)-(3), 

“9 34 CFR § 99.31 (a)(1)(i) 

*' For additional information about memoranda of understanding, see the Final Report of the Federal Commission 
on School Safety (2018), Chapter 13, “Training School Personnel to Help Ensure Student Safety” available at 
https://www2.ed.gov/documents/school-safety/school-safety-report.pdf 

34 CFR §§ 99.31 (a)(1)(i)(B)(3) and 99.33(a)(2) 

*® Subject to certain exceptions, FERPA requires the disclosing entity to make a reasonable effort to notify the 
parent or eligible student in advance of compliance with the subpoena or order. 34 CFR § 99.31 (a)(9)(ii) 
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Q.17. 


expertise, provide guidance to school officials on how to respond to the potential threat. These 
teams are more common in university settings but are also being instituted in elementary and 
secondary schools. 


Some schools may need assistance in determining whether a health or safety emergency exists 
in order to know whether a disclosure to appropriate parties (e.g., emergency responders or 
law enforcement) may be made under FERPA’s health or safety emergency exception. 
Accordingly, members of a threat assessment team include individuals who can assist in making 
such decisions, such as school principals, counselors, educators, and school law enforcement 
unit officials, as well as outside medical and mental health professionals and local law 
enforcement officers. 


In July 2004, the Department and the U.S. Secret Service jointly issued a booklet entitled, 
“Threat Assessment in Schools: A Guide to Managing Threatening Situations and to Creating 
Safe School Climates,” which includes guidance on the formation of threat assessment teams on 
pages 37-38. Information on establishing a threat assessment program, including a link to this 
booklet and other helpful resources for emergency situations, can be found on the 
Department’s website at: http://www.ed.gov/admins/lead/safety/edpicks.jhtml. 


For additional information on threat assessment teams, please also refer to joint guidance issued 
in 2013 by the Department and several federal agencies entitled, “Guide for Developing High- 
Quality School Emergency Operations Plans,” available at: http://rems.ed.gov/docs/REMS_K- 
12_Guide_508.pdf. 


Does FERPA permit schools and districts to disclose education records, without 
consent, to outside law enforcement officials, mental health officials, and other 
experts in the community who serve on a school’s threat assessment team? 


Yes, if certain conditions are met. The Department has long encouraged schools and districts to 
implement a threat assessment program that relies on teams, composed of a wide variety of 
individuals, to gather information, evaluate facts, and determine whether a health or safety 
emergency exists.44 The members of the threat assessment team should meet the criteria for 
constituting school officials under FERPA, so that they may assist the institution in gathering 
information (including Pll from education records), evaluating facts, and making institutional 
determinations, such as whether a health or safety emergency exists, and how the school or 
district should respond. Under FERPA, a school or district may disclose Pll from education 
records, without appropriate consent, to threat assessment team members who are not 
employees of the school or district to determine whether there is a health of safety emergency 
if they: 


|. Perform an institutional service or function for which the school or district would otherwise 
use employees; 


2. Are under the “direct control” of the school or district with respect to the use and 
maintenance of the education records; 


“ “Threat Assessment in Schools: A Guide to Managing Threatening Situations and to Creating Safe School 


Climates,” pages 37-38. http://www.ed.gov/admins/lead/safety/edpicks.jhtml. 
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3. Are subject to FERPA’s use and re-disclosure requirements in 34 CFR § 99.33(a), which 
provide that the Pll from education records may be used only for the purposes for which 
the disclosure was made, and which limits the re-disclosure of PIl from education records; 
and 


4. Qualify as “school officials” with “legitimate educational interests.” See Q.14 for more 
information. 


While not a requirement of FERPA, one way to ensure that members of the team are aware of 
the FERPA requirements related to the use and re-disclosure of PII obtained from education 
records is to require members of the threat assessment team to sign an acknowledgement of 
their responsibilities for safeguarding student information under FERPA. 


Schools and districts are reminded that members of a threat assessment team may only use PIl 
from education records for the purposes for which the disclosure was made, i.e., to conduct 
threat assessments, and are subject to FERPA’s re-disclosure requirements in 34 CFR § 99.33(a). 
For example, a representative from the city police who serves on a school’s threat assessment 
team generally could not give the police department any Pll from a student’s education records 
to which he or she was privy as a member of the team, unless the disclosure meets an 

exception to consent, such as a disclosure in connection with a health or safety emergency, and 
any applicable recordation requirements in FERPA are met. While school officials must make the 
ultimate determination as to whether information about a threat is sufficiently significant and 
articulable to warrant disclosure without consent to appropriate parties under the health and 
safety emergency exception, schools and districts may, at their discretion, grant non-employees 
serving as school officials on the threat assessment team the ability to make this determination 
on their behalf.45 See Q25-26 for more information on the health and safety emergency 
exception to consent. 


Law Enforcement Unit & Law Enforcement Unit Records 


Q.18. What is a “law enforcement unit’”? 


Under FERPA, “law enforcement unit” means any individual, office, department, division, or 
other component of a school or district, such as a unit of police officers or security guards, that 
is officially authorized or designated by that school or district to (1) enforce any local, State, or 
federal law, or refer to appropriate authorities a matter for enforcement of any local, State, or 
federal law, against any individual or organization other than the agency or institution itself; or 
(2) maintain the physical security and safety of the agency or institution.*6 


Schools vary in who is authorized or designated to be their law enforcement unit, usually 
depending upon school size and resources. Some larger school districts have their own fully 
equipped police units, while others have smaller security offices. Other schools designate a vice 
principal or other school official to act as the law enforcement unit officer. Other schools may — 
as discussed in Qs 21-24 — use non-school employees such as local police officers and SROs as 
their designated law enforcement unit officers. 


45 34 CFR §§ 99.31(a)(10) and 99.36 
46 34 CFR § 99.8(a)(I) 
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Q.19. 


Q.20. 


What is a law enforcement unit record? 


Law enforcement unit records are records that are: (1) created by a law enforcement unit; (2) 
created for a law enforcement purpose; and (3) maintained by the law enforcement unit.4”7 Law 
enforcement unit records are not protected by FERPA because they are specifically excluded 
from the definition of “education records” and, thus, from the privacy protections afforded to 
parents and eligible students by FERPA.*8 Therefore, investigative reports and other records 
created and maintained by law enforcement units that meet this definition are not considered 
“education records” subject to FERPA and may be released subject to school policy, State law, 
and other applicable laws. 


When members of a school’s law enforcement unit are school officials with access to students’ 
education records (or to PIl contained in those records), they may not re-disclose the records 
or Pll they receive as school officials under FERPA without appropriate consent or except as 
permitted under FERPA (see Q.20), such as if the re-disclosure is to other school officials, or 
under the health and safety emergency exception. It is, therefore, advisable for law enforcement 
units to maintain law enforcement unit records separately from education records. 


When can law enforcement unit officials serve as “school officials?” 


In order for law enforcement unit officials to be considered school officials, they must meet the 
criteria for who constitutes a school official that are set forth in the school or district’s annual 
notification to parents and eligible students of their rights under FERPA and preferably defined in 
an MOU for non-school employees.*? As explained in Qs 13-15, schools and districts must also 
determine that the school official’s interest in accessing the education records meets the criteria 
for legitimate educational interests, as set forth in the school’s or district’s annual notification of 
FERPA rights. A school official typically would have a “legitimate educational interest” if the 
official needs to review an education record in order to fulfill his or her professional or 
delegated responsibility. 


Having law enforcement unit officials who are “school officials” with “legitimate educational 
interests” will permit a school to disclose Pll from students’ education records, without 
appropriate consent, to its law enforcement unit officials so that they may perform their 
professional duties and assist with school safety matters. For example, if a student is expelled 
from school and barred from campus the principal could disclose the student’s disciplinary 
report to law enforcement unit officials so that they would know that the student should not be 
on campus. The Pll from the student’s education records that is provided to the school’s law 
enforcement unit officials remains subject to FERPA and may only be further disclosed by that 
unit (e.g., to the local police department) with consent or as otherwise permitted under 
FERPA®°, such as making a disclosure to comply with a lawfully issued subpoena®! or the 


“7 34 CFR § 99.8(b)(1) 

“8 34 CFR § 99.3, “Education Records” 

“? 34 CFR § 99.7(a)(3)(iii) 

°° 34 CFR § 99.33. To be permissible under FERPA, any such redisclosures must be on behalf of the educational 
agency or institution, and must meet the requirements of one or more of the exceptions to consent at 34 CFR 


99.31. 


5! 34 CFR § 99.31 (a)(9) 
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disclosure is in connection with a health or safety emergency,52 and provided FERPA’s 
recordkeeping requirements have been met.*3 


Utilizing Local Police Officers and SROs as School Law Enforcement Unit Officials 


Q.21. 


Q.22. 


Q.23. 


Q.24. 


Does a school or district have to use only employees to staff its law enforcement 
unit? 


No. The manner in which a school or district staffs its law enforcement unit is not addressed by 
FERPA. Accordingly, FERPA does not require a school or district to use only employees to staff 
its law enforcement unit and may contract out those services. 


Are SROs or other outside local law enforcement officials who serve as a school’s 
law enforcement unit automatically considered school officials? 


Not automatically. Subject to the conditions indicated in Q.15 relative to outsourcing 
institutional services or functions, these officials may be considered “school officials” with 
“legitimate educational interests” and may have access to students’ education records. 


Can a school provide local or other law enforcement officials with “directory 
information” on students? 


Yes. If the school or district has a directory information policy under FERPA that permits this 
disclosure to local or other law enforcement officials, then the directory information of those 
students whose parents (or those eligible students who) have not opted out of such a disclosure 
may be disclosed without appropriate consent.*4 See the related discussion in Q.7. 


Does FERPA distinguish between SROs and other local police officers who work in a 
school? 


No. As noted previously, an SRO typically serves as an on-site law enforcement officer and as a 
liaison with the local police or sheriffs department. An SRO may be designated by a school or 
district as a “law enforcement unit” official under FERPA.55 However, in order for a school or 
district to disclose education records (or any PII contained in those records) to an SRO, 
without appropriate consent, the disclosure must satisfy an exception to FERPA’s general 
written consent requirement such as the “school official” exception under which the SRO must 
be considered a “school official” with a “legitimate educational interest” under FERPA. See Qs 
15 and 22. 


As explained in Q.15, the school or district must have direct control over an SRO’s 
maintenance and use of education records in providing SRO services in order for the SRO to be 
considered a school official. Additionally, as explained in Q.13, schools and districts must use 
reasonable methods to ensure that school officials obtain access to only those education 
records in which they have legitimate educational interests. Further, under the school official 
exception (as well as any FERPA exception to consent), SROs may only use the Pll from 


52 34 CFR §§ 99.31(a)(10) and 99.36 
53 34 CFR § 99.32 

54 34 CFR §§ 99.31(a)(I1) and 99.37 
55 34 CFR § 99.8(a)(I) 
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education records for the purposes for which the disclosure was made, e.g., to promote school 
safety and the physical security of the students.>¢ In addition, SROs are subject to FERPA’s re- 
disclosure limitations.5”? This means that an SRO who is serving as a “school official” under 
FERPA may not disclose Pll from education records to others, including other employees of his 
or her local police department who are not acting as school officials, without consent unless: 
(1) the re-disclosure is on behalf of the educational agency or institution; (2) the re-disclosure 
fits within one of the exceptions to FERPA’s consent requirement (see Qs |5 and 17); and (3) 
the recordkeeping requirements in 34 CFR § 99.32 have been met. 


Other Exceptions to FERPA’s General Consent Rule Relevant to School Safety 


Health or Safety Emergencies 


Q.25. 


Q.26. 


When is it permissible for schools or districts to disclose, without appropriate 
consent, student education records (or PII contained in those records) under 
FERPA’s health or safety emergency exception? 


In some situations, school administrators may determine that it is necessary to disclose a 
student’s education records (or PIl contained in those records) to appropriate parties in order 
to address a specific and articulable threat of a health or safety emergency. FERPA’s health or 
safety emergency provision permits such disclosures when the disclosure is necessary to protect 
the health or safety of the student or other individuals.°8 This exception to FERPA’s general 
consent requirement is limited to the period of the emergency and does not allow for a blanket 
release of Pll from a student’s education records. Rather, these disclosures must be related to a 
significant and articulable emergency, such as an impending natural disaster, a terrorist attack, a 
campus threat, or the outbreak of an epidemic disease. Please refer to the following previously 
issued Department guidance entitled, “Addressing Emergencies on Campus,” issued in June 
2011, for additional information: https://studentprivacy.ed.gov/resources/addressing- 
emergencies-campus. 


Who are considered “appropriate parties” that may receive information under the 
health or safety emergency exception? 


An appropriate party under the health or safety emergency exception to FERPA’s general 
consent requirements is a party whose knowledge of such information is necessary to protect 
the health or safety of the student or other persons. Typically, local or State law enforcement 
officials, public health officials, trained medical personnel, and parents (including parents of an 
eligible student) are the types of appropriate parties to whom schools and districts may disclose 
information under this FERPA exception.5? 


°6 34 CFR §§ 99.31 (a)(1)(i)(B)(3) and 99.33(a)(2). 

°” 34 CFR § 99.33(a) 

°° 34 CFR §§ 99.31 (a)(10) and 99.36 

*? Please refer to the following previously issued Department guidance entitled, “Addressing Emergencies on 
Campus,” issued in June 2011, for additional information: https://studentprivacy.ed.gov/resources/addressing- 
emergencies-campus 
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Q.27. 


Q.28. 


Q.29. 


Q.30. 


Q.31. 


How does a school or district know when a health or safety emergency exists so 
that a disclosure may be made under this exception to consent? 


A school or district must make this determination on a case-by-case basis, taking into account 
the totality of the circumstances pertaining to a threat to the health or safety of a student or 
others. If the school or district determines that there is an articulable and significant threat to 
the health or safety of a student or other individuals and that one or more third parties (e.g., law 
enforcement officials, public health officials, trained medical personnel, parents, etc.) need 
education records (or Pll contained in those records) in order to protect the health or safety of 
the student or other individuals, it may disclose that information to the appropriate parties 
without consent. 


What does “articulable and significant threat” mean? 


This is a flexible standard under which the Department generally defers to school officials so 
that they might respond appropriately. In applying this standard, a school official should be able 
to explain the basis for his or her reasonable belief, based on all the available information, as to 
why a given student poses an “articulable and significant threat.” The phrase “articulable and 
significant threat” means that a school official is able to explain, based on all the information 
available at the time, what the threat is and why it is significant when he or she makes and 
records the disclosure.®! 


May a school make disclosures under FERPA’s health or safety emergency 
exception for emergency preparedness exercises? 


No. Disclosures made under the health or safety emergency exception must be “in connection 
with an emergency,” which means it must be related to an actual, impending, or imminent 
emergency, such as a natural disaster, a terrorist attack, a campus threat, or the outbreak of an 
epidemic disease. 


Does a school have to record disclosures made under FERPA’s health or safety 
emergency exception? 


Yes. When a school or district makes a disclosure under the health or safety exception, it must 
record in the student’s education records the articulable and significant threat that formed the 
basis for the disclosure, and the parties to whom the information was disclosed.6? (The 
recordkeeping requirements for disclosures under the health or safety emergency exception are 
different than the recordkeeping requirements for other disclosures discussed in Q.1 1.) 


Are there other situations in which school officials may non-consensually disclose 
PIl from education records of students who have been disciplined for conduct that 
posed a significant risk to the safety of the school community to officials at another 
school? 


Yes. Under FERPA, a school or district may disclose appropriate information concerning 
disciplinary action taken against a student who has been disciplined for conduct that posed a 
significant risk to the safety or well-being of that student, other students, or other members of 


69 34 CFR § 99.36(c). 
‘| 34 CFR § 99.36 
©2 34 CFR § 99.32(a)(5) 
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the school community, to school officials at another school. The school must determine that the 
other school has a legitimate educational interest in the behavior of the student.® 


For instance, a school official knows that a student, who had recently been disciplined for 
bringing a weapon to school, was overheard threatening to hurt students or teachers at a 
school-sponsored activity at another school. In this instance, FERPA would allow that school 
official to notify school officials at the other school who have been determined to have 
legitimate educational interests in the behavior of the student.* Please note that this exception 
does not permit the non-consensual disclosure of information concerning disciplinary action 
taken against a student for behavior that did not pose a significant risk to the safety or well- 
being of that student, other students, or other members of the school community (see Q.28). 


Judicial Orders or Lawfully Issued Subpoenas 


Q.32. May schools comply with a subpoena or court order for education records without 
the consent of the parent or eligible student? 


Yes, although a reasonable effort to notify the parent or eligible student is generally required. 
FERPA permits disclosure of education records without consent in compliance with a lawfully 
issued subpoena or judicial order.65 However, a school or district must generally make a 
reasonable effort to notify the parent or eligible student of the subpoena or judicial order 
before complying with it in order to allow the parent or eligible student the opportunity to seek 
protective action, unless certain exceptions apply. Exceptions to the requirement of making a 
reasonable effort to provide prior notification apply to: (1) a federal grand jury subpoena or 
other subpoena issued for a law enforcement purpose if the court or other issuing agency, for 
good cause shown, has ordered that the existence or the contents of the subpoena or the 
information furnished in response to the subpoena not be disclosed; and (2) an ex parte order 
obtained by the United States Attorney General (or designee not lower than Assistant Attorney 
General) concerning investigations or prosecutions of an act of terrorism or other specified 
offenses.6¢ For example, if a school received a law enforcement subpoena that requested PIl 
about a student suspected of selling drugs, it would not have to make an effort to notify the 
parent or eligible student if the court or other issuing agency, for good cause shown, had 
ordered that the existence or the contents of the subpoena or information furnished in 
response to the subpoena not be disclosed. 


Transfer to New Schools 


Q.33. Does FERPA permit schools to disclose any and all education records on a student 
to another school where the student seeks or intends to enroll? 


Yes. FERPA permits a school or district to disclose education records (or Pll contained in those 
records) without appropriate consent to another school or school system in which a student 


$3 34 CFR § 99.36(b)(3) 
“4 34 CFR § 99.36(b)(3). 
$20 US.C. § 1232g(b)(2)(B); 34 CFR § 99.31 (a)(9)(i) and (ii) 
6 20 US.C. §§ 1232g(b)(1)(J) and (j); 34 CFR § 99.31(a)(9)(ii) 
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seeks or intends to enroll, subject to certain conditions.*” This exception to FERPA’s general 
consent requirement also permits a school to disclose education records when a student is 
being placed in a juvenile justice facility that is considered a school. 


Are schools required to transfer certain student disciplinary records to other 
schools where the student seeks or intends to enroll? 


It depends on State procedures. A State receiving funds under the Elementary and Secondary 
Education Act of 1965, as amended (ESEA),¢8 was required, not later than January 8, 2004, to 
provide an assurance to the Secretary that they had “a procedure in place to facilitate the 
transfer of disciplinary records, with respect to a suspension or expulsion, by local educational 
agencies to any private or public elementary school or secondary school for any student who is 
enrolled or seeks, intends, or is instructed to enroll, on a full- or part-time basis, in the school.” 
Schools and districts, therefore, should include a notice in their annual notification of rights 
under FERPA that they forward such student disciplinary records with respect to a suspension 
or expulsion by local educational agencies to other elementary or secondary schools that have 
requested the records and in which the student seeks or intends to enroll.¢® Unless the school 
or district includes this notice in its annual notification of FERPA rights or the parent or eligible 
student initiates the transfer of records, the school or district otherwise would be required to 
make a reasonable effort to notify the parent or eligible student of the disclosure at the last 
known address of the parent or eligible student.7° (See the model notification of rights: 
https://studentprivacy.ed.gov/resources/ferpa-model-notification-rights-elementary-secondary- 
schools 


Juvenile Justice System 


Q.35. 


Does FERPA permit the disclosure of PII from education records to officials of a 
State’s juvenile justice system? 


Yes, under certain conditions. FERPA permits schools to non-consensually disclose education 
records and the PIl contained therein to State and local officials or other authorities if the 
disclosure is specifically: (1) allowed to be reported or disclosed by a State law adopted prior 
to November 19, 1974, if the allowed reporting concerns the juvenile justice system and the 
system’s ability to effectively serve the student whose records are released; or (2) allowed to be 
reported or disclosed by a State law adopted after November 19, 1974, if the disclosure 
concerns the juvenile justice system and its ability to serve, prior to adjudication, the student 
whose records are disclosed and the officials and authorities to whom the records are disclosed 
certify in writing to the school or district that the information will not be provided to any other 
party, without written consent, except as provided for under State law.7! 


67 34 CFR § 99.31 (a)(2)), 34 CFR § 99.34 

8 20 US.C. § 7917(b) 

©? 34 CFR §§ 99.7, 99.31 (a)(2), and 99.34(a)(1)(ii)) 
70 34 CFR § 99.34(a)(I) 

7! 34 CER §§ 99.31(a)(5) and 99.38 
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Release of Information Not Considered Education Records 


Personal Knowledge and Observation 


Q.36. 


Q.37. 


Does FERPA permit school officials to release information that they personally 
observed or of which they have personal knowledge? 


Because FERPA applies to the disclosure of education records and of Pll from education records 
that are maintained by the school, FERPA does not prohibit a school official from releasing 
information about a student that was obtained through the school official’s personal knowledge 
or observation, rather than from the student’s education records. 


Are there any limitations to sharing information based on personal knowledge or 
observations? 


The general rule regarding personal knowledge and observations does not apply where a school 
official learns of information about a student through his or her official role in making a 
determination about the student and the determination is maintained in an education record. 
For example, under FERPA, neither a principal nor any other school official who took official 
action to suspend a student may disclose information learned in that process, absent appropriate 
consent or an exception to consent under 34 CFR § 99.31 that permits the disclosure. 
However, the principal or other school official could disclose information about the student’s 
behavior that they personally observed. 
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Resources 

> U.S. Department of Education, Student Privacy Policy Office (formerly called the Family Policy 
Compliance Office): https://studentprivacy.ed.gov 

> US. Department of Education, Privacy Technical Assistance Center: 
https://studentprivacy.ed.gov 

> Family Educational Rights and Privacy Act Regulations: https://studentprivacy.ed.gov/ferpa- 
regulations 

> Federal regulations resources web page at the U.S. Department of Education: 
https://www.ed.gov/policy/gen/reg/edpicks.jhtm!| 

> U.S. Department of Education (2013): Guide for Developing High-Quality School Emergency 
Operations Plans, available at: http://rems.ed.gov/docs/REMS_K-1|2_Guide_508.pdf 

> U.S. Department of Education, Family Policy Compliance Office (2011): Addressing Emergencies 
on Campus, available at: https://studentprivacy.ed.gov/resources/addressing-emergencies-campus 

> U.S. Department of Education, Privacy Technical Assistance Center (2014): FERPA Exceptions 
Summary, available at https://studentprivacy.ed.gov/resources/ferpa-exceptions-summary-large- 
format-||-x-17 

> U.S. Department of Education, Privacy Technical Assistance Center, FAQs on Photos and 
Videos under FERPA, available at: https://studentprivacy.ed.gov/faq/faqs-photos-and-videos- 
under-ferpa 

> U.S. Department of Education, Family Policy Compliance Office (2017): Model Notification of 
Rights under FERPA for Elementary and Secondary Schools, available at: 
https://studentprivacy.ed.gov/node/490 

> Final Report of the Federal Commission on School Safety (2018), Chapter 13, "Training School 
Personnel to Help Ensure Student Safety," available at: https://www2.ed.gov/documents/school- 
safety/school-safety-report.pdf 

> United States Secret Service and U.S. Department of Education, (2004): Threat Assessment in 


Schools: A Guide to Managing Threatening Situations and to Creating Safe School Climates, 
available at: http://www.ed.gov/admins/lead/safety/edpicks.jhtml 
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